How Should You Configure AWS Network Firewall Logging for Complete Traffic Metadata?

ANS-C01 By islever Editorial Last updated Aug 8, 2026

Short answer

C Create a firewall policy to ensure that a stateful engine processes all the traffic. Configure Network Firewall logging for alert logs and flow logs. Select a destination for alert logs and flow logs.

Question

A company wants to use an AWS Network Firewall firewall to secure its workloads in the cloud through network traffic inspection. The company must record complete metadata information, such as source/destination IP addresses and protocol type. The company must also record all network traffic flows and any DROP or ALERT actions that the firewall takes for traffic that the firewall processes. The Network Firewall endpoints are placed in the correct subnets, and the VPC route tables direct traffic to the Network Firewall endpoints on the path to and from the internet. How should a network engineer configure the firewall to meet these requirements?

Create a firewall policy to ensure that traffic is processed by stateless or stateful rules according to needs. Select Amazon CloudWatch Logs as the destination for the flow logs.
Create a firewall policy to ensure that traffic is processed by stateless or stateful rules according to needs. Configure Network Firewall logging for alert logs and flow logs.
Create a firewall policy to ensure that a stateful engine processes all the traffic. Configure Network Firewall logging for alert logs and flow logs. Select a destination for alert logs and flow logs. Correct Answer
Create a firewall policy to ensure that a stateful engine processes all the traffic. Configure VPC flow logs for the subnets that the firewall protects. Select a destination for the flow logs.

Key Takeaways

This question tests whether you know that Network Firewall logging is available only for traffic forwarded to the stateful rules engine, so the policy must send all traffic through that engine rather than just enabling log destinations.

To capture complete traffic metadata and all DROP/ALERT actions from AWS Network Firewall, you must forward all traffic to the stateful rules engine and enable both alert and flow logs. The community consensus favors option C because firewall logging is only available for traffic that reaches the stateful engine.

Common mistake: Option B is a common wrong answer because it correctly enables alert and flow logs but allows stateless rule actions to bypass the stateful engine, which means traffic would flow without generating the required Network Firewall logs.

Expert Analysis

Why C Is Correct

AWS Network Firewall uses both a stateless engine and a stateful engine. Logging, including flow logs and alert logs, is generated only by the stateful engine. The official AWS Network Firewall logging documentation states that firewall logging is only available for traffic that you forward to the stateful rules engine. Therefore, to meet the requirement to record all network traffic flows and any DROP or ALERT actions, the firewall policy must ensure that all traffic is sent to the stateful engine. Option C does this by creating a policy where the stateful engine processes all traffic and by configuring both alert logs and flow logs with a destination.

Option A is incomplete because it only configures flow logs and selects CloudWatch Logs as the destination; it does not configure alert logs for DROP/ALERT actions. Option B configures alert and flow logs but allows traffic to be processed by stateless or stateful rules "according to needs." If stateless rules pass traffic without forwarding it to the stateful engine, that traffic will not be logged, violating the requirement. Option D uses VPC Flow Logs instead of Network Firewall logging. VPC Flow Logs can show IP traffic metadata, but they do not capture the firewall-specific DROP/ALERT actions taken by AWS Network Firewall rules.

Community comments also highlight this point. Several candidates noted that "Firewall logging is only available for traffic that you forward to the stateful rules engine." This is why the answer must include both the stateful-engine requirement and the correct log types. The most upvoted answer was C, and the AWS documentation supports that choice.

Official Reference

https://docs.aws.amazon.com/network-firewall/latest/developerguide/firewall-logging.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

For AWS Network Firewall questions, remember that logs come from the stateful engine only. When a requirement asks for all flows and alert/drop actions, choose an answer that forces all traffic into the stateful engine and configures both flow and alert logs.

Community Votes

62%

38%

62% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 9 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 9

[Removed] 👍 3 Answered C

By doc, already sent, voting to help https://docs.aws.amazon.com/network-firewall/latest/developerguide/firewall-logging.html Note Firewall logging is only available for traffic that you forward to the stateful rules engine. You forward traffic to the stateful engine through stateless rule actions and stateless default actions in the firewall policy.
seongheon 👍 3 Answered C

C : Firewall logging is only available for traffic that you forward to the stateful rules engine. You forward traffic to the stateful engine through stateless rule actions and stateless default actions in the firewall policy.
c1193d4 👍 3 Answered C

Firewall logging is only available for traffic that you forward to the stateful rules engine.
JoellaLi 👍 2 Answered B

You can configure AWS Network Firewall logging for your firewall's stateful engine. Logging gives you detailed information about network traffic, including the time that the stateful engine received a packet, detailed information about the packet, and any stateful rule action taken against the packet. The logs are published to the log destination that you've configured, where you can retrieve and view them.
acloudguru 👍 2 Answered B

Option D: Using VPC Flow Logs would capture network traffic flows, but it would not capture the specific DROP or ALERT actions taken by the AWS Network Firewall. Additionally, VPC Flow Logs do not provide the same level of detail and metadata as the Network Firewall flow logs

Show 4 more comments

KobDragoon 👍 2 Answered B

B is the right answer, not all traffic needs to be processed by the stateful engine like C suggests
Spaurito 👍 1

B - You can configure AWS Network Firewall logging for your firewall's stateful engine. Logging gives you detailed information about network traffic, including the time that the stateful engine received a packet, detailed information about the packet, and any stateful rule action taken against the packet. The logs are published to the log destination that you've configured, where you can retrieve and view them. This meets the requirements best.
arturogomezb 👍 1

Firewall logging is only available for traffic that you forward to the stateful rules engine. You forward traffic to the stateful engine through stateless rule actions and stateless default actions in the firewall policy. For information about these actions settings, https://docs.aws.amazon.com/network-firewall/latest/developerguide/firewall-logging.html
46f094c 👍 1 Answered C

B doesn't mention the "engine". "...Firewall logging is only available for traffic that you forward to the stateful rules engine..." so no engine, no logging

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide